services:
  vault:
    image: hashicorp/vault:1.19.2
    container_name: vault
    restart: unless-stopped
    ports:
      - "8200:8200"
      - "8201:8201"
    environment:
      TZ: {{TZ}}
      VAULT_ADDR: https://127.0.0.1:8200
      VAULT_LOG_LEVEL: info
      VAULT_SKIP_VERIFY: "false"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./appdata/vault/config:/vault/config:ro
      - ./appdata/vault/tls:/vault/tls:ro
      - vault_data:/vault/data
      - vault_logs:/vault/logs
    cap_add:
      - IPC_LOCK
    command: vault server -config=/vault/config/vault.hcl
    networks:
      - vault_network
    healthcheck:
      test: ["CMD-SHELL", "wget --no-check-certificate --no-verbose --tries=1 --spider https://localhost:8200/v1/sys/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M
    security_opt:
      - no-new-privileges:true
    logging:
      driver: json-file
      options:
        max-file: "{{DOCKERLOGGING_MAXFILE}}"
        max-size: "{{DOCKERLOGGING_MAXSIZE}}"

networks:
  vault_network:
    driver: bridge
    name: vault_network

volumes:
  vault_data:
  vault_logs: